WSO2 vulnerabilities
Security vulnerabilities in WSO2's enterprise identity and API management platforms, including WSO2 Identity Server, API Manager, and related integration products deployed across financial services and enterprise environments.
We track 2 WSO2 CVEs, 2 of them on CISA's Known Exploited Vulnerabilities catalog (1 flagged for ransomware use). The latest KEV addition is CVE-2026-5430, added .
- CVEs tracked
- 2
- On CISA KEV
- 2
- Ransomware use
- 1
- Rated critical
- 2
Latest WSO2 coverage
Our reporting filed under WSO2, plus any story that cites one of its CVEs.
SharePoint Code Injection CVE-2026-65660 Added to KEV
CISA added a SharePoint code injection flaw to its KEV catalog on September 25. CVSS 8.8, active exploitation confirmed, federal patch deadline September 28.
Kiteworks Flags Potential Zero-Day, Urges Server Shutdown
Kiteworks warned customers Thursday of potential zero-day attack activity and asked them to take servers offline for a six-hour window on Saturday, September 26.
CISA KEV: WSO2 and Adobe Commerce Flaws Exploited
CISA added CVE-2026-5430 (WSO2, CVSS 10.0) and CVE-2026-71362 (Adobe Commerce, CVSS 9.1) to KEV on September 24. Federal patch deadline: September 27.
WSO2 CVSS 10 JWT Bypass Exploited in the Wild
CVE-2026-5430 lets unauthenticated attackers forge JWTs and gain administrative access to WSO2 deployments. Active exploitation confirmed. Patch immediately.
Known exploited WSO2 vulnerabilities
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2026-5430 WSO2 Multiple Products Path Traversal to RCEwrite-up | [ CRITICAL ] | 10.0 | 22.4% | ||
| CVE-2022-29464 WSO2 Multiple Products Unrestrictive Upload of File Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 100.0% |
Every WSO2 CVE on CISA's KEV catalog that we hold, newest KEV addition first. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else.
Machine-readable: /api/v1/vendors/wso2.json.
Every CVE row links to its record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker, the vendor scorecard, or all vendors.